Issues with CapitalOne360 website

timmed

Just downloaded the Mac+Windows combo during the 50% off sale. Must say, I LOVE this software, very cool and is encouraging me to use more complex passwords, and vary them more between my accounts. I have found only 1 site that doesn't work with the product. When logging in to Capital One 360, they use a number pad to supply your pin#. The pin must be numeric, you click on the keypad to enter your pin to authenticate. Is there any way to get that stored/filled in 1Password? 1Password tries to save the pin, but it just ends up being some random characters that don't match my pin#, and then when I try to re-enter the site it just does nothing when I click the saved login on the browser extension.

Thanks, Tim

sjk

Hi Tim ( @timmed ),

Thanks for supporting 1Password with your combo license purchase. I'm so happy to hear you're loving the software and making good use of it for creating securer passwords! :)

About that Capital One 360 PIN# entry keypad, it sounds like you're having the same issue that @MikeT previously commented on:

The Keypad is usually using a special technology that doesn't allow others to read the data or fill in the data. I assume CapitolOne is using that technology and thus, 1Password couldn't save/fill it.

However, it can't hurt to give his manual saving suggestion there a try and hopefully get a working item for filling your PIN#.

Please let us know how that goes. It it fails, maybe there's an alternative login page we can help you find that will work correctly with 1Password.

benfdc

The solution to the PIN entry problem is to click the keyboard link that is directly above the keypad. This opens a normal password entry field that 1Password can reliably fill. It would be great if there were a way to “tell” 1Password to click that link rather than having to do so manually.

I have a bigger problem with the first sign-in page. This page contains a text field for entering one’s username and a Hide My Typing checkbox that, if checked before the username is entered, will obscure the username password-style as it is being entered. 1Password fills in my username and then checks the checkbox. This sequence does not work; it leaves my randomly-generated username exposed to screen-scrapers and shoulder-surfers.

Hiding the username is an important security option on the Capital One 360 website because it is easier to construct a “strong“ username than a strong numeric PIN. I want 1Password to click the Hide My Typing checkbox before it fills in my username, and I don’t know how to get what I want.

1Password 4 for Mac does not allow users either to re-order web details fields in login items or to create new ones. 1Password 3 does not allow reordering either, but it does allow users to create new fields. I opened my keychain in 1Password 3.5, duplicated my Capital One 360 login, and edited the copy by creating a new username field and deleting the original field. I now had a login with all of the same information, but modified so that (I hoped) the hideMyTyping checkbox would be filled in before the username. It didn’t work—the username filled in, visibly, but the hideMyTyping checkbox was not checked at all.

Any suggestions?

sjk

Hey @benfdc,

Which web browser(s) and version(s) of the 1Password extension(s) have you tried this with? The results of my testing different combinations have been "interesting" and I'd like to see if I can specifically reproduce yours. Thanks!

benfdc

Thanks for looking into this, @sjk.

I'm presently running 1Password 4.4.2.BETA-3 (442003) and Google Chrome 36.0.1985.125 with the 1Password Beta 4.2.4.2 extension under OS X 10.8.5. The same Chrome extension is installed in Opera Next, if that counts for anything.

mike429

benfdc: Are you sure that works to click the keyboard field? The site randomly assigns a single letter for each number key on the PIN keypad, and it's different each time you visit the site.

sjk

Thanks, @benfdc.

Testing here with the same software, except OS X 10.9.4 instead of 10.8.5, 1Password initially fills the Username field asterisk-masked on the https://secure.capitalone360.com/myaccount/banking/login.vm page regardless of the Hide My Typing option (hideMyTyping web form field), e.g.:

However, if the form is repeatedly refilled using an item with hideMyTyping disabled then the Username field masking is toggled with each fill. And if hideMyTyping is enabled then the field masking persists with each fill. Behaves this way with the 4.2.4.BETA-2 extension in every browser, not just Chrome.

Can you replicate that, or am I misunderstanding the issue you're having?

@mike429 and @benfdc‌, is the Capital One 360 keypad similar to the one for Westpac Online Banking?

ref: OPX-323

benfdc

@sjk—

I logged in, signed out, logged in again, signed out again, logged in again.

First and third times, the username filled in like a password and Hide My Typing was not checked. Second time, it was reversed.

WTF?

mike429

Responding to: "@mike429 and @benfdc‌, is the Capital One 360 keypad similar to the one for Westpac Online Banking?"

They're similar in the security approach -- process clicks instead of text input. The Westpac site offers a full QWERTY soft keyboard to work with, and displays bullets each time you click on a letter, to provide some feedback. You can't copy to or paste from that field. On the Capital One 360 site it's just a 10-digit "PINpad", with the same idea. But the Capital One site allows an alternative form of entry: if you select "keyboard", then the PINpad is redrawn with each number key also displaying a substitute alphabetic letter, generated randomly. You can then type the corresponding letters for your PIN into a data entry field. In this circumstance, 1PW will actually save those letters that you type for the password, but it's of no value since the next time you access the site it will have a different set of letters mapped to the PINpad. The other difference from Westpac is that Westpac has both username and password on the same page, but Capital One is a two-screen log-in.

benfdc

@‌mike429 writes:

You can then type the corresponding letters for your PIN into a data entry field. In this circumstance, 1PW will actually save those letters that you type for the password, but it's of no value since the next time you access the site it will have a different set of letters mapped to the PINpad.

You can type in letters OR NUMBERS, so 1Password easily and securely fills in my actual PIN.

mike429

You can type in letters OR NUMBERS, so 1Password easily and securely fills in my actual PIN.

benfdc: Interesting! My experience is different, but your comment inspired some additional experimentation on my end that led to a satisfying outcome. When I select "keyboard", the data entry field will accept typed letters but NOT typed numbers. I'm on a MacBook Pro that doesn't have a numeric keypad, just the top row of numbers and they are definitely inactive as far as data entry goes. Could it be that they programmed the number keys to be ignored but overlooked the numeric keypad? You didn't actually say how you type the numbers, so I'm just speculating on what the difference could be. But in any case, despite the inability in my case to type the numbers, I was able to save my numeric PIN into 1PW and have it successfully paste it into the data entry field and proceed with a successful log-in. Thanks for the tip!

benfdc

Now running beta Chrome extension 4.2.5.1 and things are working as they should. Consistently. Thanks, folks!

Samtheman67

Cap One Banking keeps asking for my user name. 1PW will not fill in but will fill in the password. Just started this weekend. Any ideas?

Samtheman67

Tried to login as usual but login is skipping over username and correctly logging in the pass word. I have to manually put in the username
and it will work fine. Any ideas when cap one started to have this problem?

Stephen_C

I have merged your post into the existing thread discussing issues with the CapitalOne login.

Stephen

timmed

Update! CapitalOne360 finally joined the 21st century and updated their website. They got rid of the clunky telephone pad to enter a Pin# and now take a normal userid/password. Everything is worked great now.

Megan

Hi @timmed,

What a great bit of news! Thanks so much for sharing it here. Huzzah for joining the 21st century, CapitalOne! :)